The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

- update to 1.1.15 (bnc#768680) :

  - security fix: complete authz support for remote SVN     views (CVE-2012-3356)

  - security fix: log msg leak in SVN revision view with     unreadable copy source (CVE-2012-3357)

Additionally the following non-security issues have been addressed :

  - fix several instances of incorrect information in remote     SVN views

  - increase performance of some revision metadata lookups     in remote SVN views

  - fix RSS feed regression introduced in 1.1.14

  - fix annotation of svn files with non-URI-safe paths

  - handle file:/// Subversion rootpaths as local roots

  - fix bug caused by trying to case-normalize anon     usernames

  - speed up log handling by reusing tokenization results

  - add support for custom review log markup rules

  - fix svndbadmin failure on deleted paths under Subversion     1.7

  - fix annotation of files in svn roots with non-URI-safe     paths

  - fix stray annotation warning in markup display of images

  - more gracefully handle attempts to display binary     content

  - fix path display in patch and certain diff views

  - fix broken cvsdb glob searching

  - allow svn revision specifiers to have leading r's

  - allow environmental override of configuration location

  - fix exception HTML-escaping non-string data under WSGI

  - add links to root logs from roots view

  - use Pygments lexer-guessing functionality

  - add supplements for apache2/subversion-server

Updated viewvc packages fix security vulnerabilities :

complete authz support for remote SVN views (CVE-2012-3356).

log msg leak in SVN revision view with unreadable copy source (CVE-2012-3357).

function name lines returned by diff are not properly escaped, allowing attackers with commit access to perform cross site scripting (CVE-2012-4533).

Several other bugs were fixed as well.

Several vulnerabilities were found in ViewVC, a web interface for CVS and Subversion repositories.

  - CVE-2009-5024     Remote attackers can bypass the cvsdb row_limit     configuration setting, and consequently conduct     resource-consumption attacks via the limit parameter.

  - CVE-2012-3356     The remote Subversion views functionality does not     properly perform authorization, which allows remote     attackers to bypass intended access restrictions.

  - CVE-2012-3357     The Subversion revision view does not properly handle     log messages when a readable path is copied from an     unreadable path, which allows remote attackers to obtain     sensitive information.

  - CVE-2012-4533     'function name' lines returned by diff are not properly     escaped, allowing attackers with commit access to     perform cross site scripting.

Version 1.1.14 (released 12-Jun-2012)

  - fix annotation of svn files with non-URI-safe paths     (issue #504)

    - handle file:/// Subversion rootpaths as local roots       (issue #446)

    - fix bug caused by trying to case-normalize anon       usernames (issue #505)

    - speed up log handling by reusing tokenization results       (issue #506)

    - add support for custom review log markup rules (issue       #429)

Version 1.1.15 (released 22-Jun-2012)

  - security fix: complete authz support for remote SVN     views (issue #353)

    - security fix: log msg leak in SVN revision view with       unreadable copy source

    - fix several instances of incorrect information in       remote SVN views

    - increase performance of some revision metadata lookups       in remote SVN views

    - fix RSS feed regression introduced in 1.1.14

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74665	openSUSE Security Update : viewvc (openSUSE-SU-2012:0831-1)	Nessus	SuSE Local Security Checks	medium
66146	Mandriva Linux Security Advisory : viewvc (MDVSA-2013:134)	Nessus	Mandriva Local Security Checks	medium
62665	Debian DSA-2563-1 : viewvc - several vulnerabilities	Nessus	Debian Local Security Checks	medium
59951	Fedora 17 : viewvc-1.1.15-1.fc17 (2012-9433)	Nessus	Fedora Local Security Checks	medium
59950	Fedora 16 : viewvc-1.1.15-1.fc16 (2012-9371)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-3356

critical

Tenable Plugins

medium

medium

medium

medium

medium